General discussion

Locked

smss.exe doesn't stop when shutting down

By pcmaster ·
When logging off, shutting down or restarting, I get an error message saying the smss.exe hasn't stopped running and then I have to hit the End button to get it to shut down or restart.

I just resently got the GRAPS virus and successfully removedall the infected files according to the instructions. This just started since the infection. I re applied SP4, but it seemed to make no difference. Anyone have ideas?

This conversation is currently closed to new comments.

8 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

smss.exe doesn't stop when shutting down

by pctech In reply to smss.exe doesn't stop whe ...

Hi

Here is the information I found concerning smss.exe:

http://www.liutilities.com/products/wintaskspro/processlibrary/smss/

Here is the information I found concerning the Graps virus:

http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.graps.html

This is something else Syamntec says the virus can do, "Opens port 45836 and listens for incoming connections. The backdoor commands allow a hacker to perform the following actions:
Deliver system information
Launch Denial of Service (DoS) attacks against selected targets
Install SMTP, IRC, and HTTP proxies so that the connected backdoor client can be used to anonymously send spam, operate as an IRC client, and browse the Internet." You need to assure you have these ports and services closed.

I suspect that the virus is still active, has caused corruption, and/or a hacker still has access to your system. Since this virus is network aware, I need to ask if you are connected to other computers. If so, you need to check every system on the network. Take every system off the network and run a virus scan on them. Did you disable the system restore function before removing the virus?

Collapse -

smss.exe doesn't stop when shutting down

by pcmaster In reply to smss.exe doesn't stop whe ...

See added comments

Collapse -

smss.exe doesn't stop when shutting down

by pcmaster In reply to smss.exe doesn't stop whe ...

I'm running Windows 2000 Pro so it doesn't have system restore. I believe that is an XP function. I did, however, go into Safe Mode as instructed by Symantec, performed a full scan with an updated Norton AV, identified the virus files and deleted them from the system, including the (3) wds.bat files. Edited the registry and removed the mdw.exe value as instructed. Also, located the mdw.exe file and deleted it as well.

Then, I re entered safe mode, did a full system scan and it reported no viruses. I'm on a network, however none of the other computers have the virus at all. I'm stumped.

Collapse -

smss.exe doesn't stop when shutting down

by d.walker5 In reply to smss.exe doesn't stop whe ...

Download the Service Pack 4. This should fix the problem.

Collapse -

smss.exe doesn't stop when shutting down

by pcmaster In reply to smss.exe doesn't stop whe ...

Already did this. Didn't change anything

Collapse -

smss.exe doesn't stop when shutting down

by Thamer In reply to smss.exe doesn't stop whe ...

Background:
SMSS is the Session Manager SubSystem found in Windows NT4/2000/XP only with a purpose to start, manage, and delete user sessions (or client sessions under Terminal Server). Under Terminal Server the management part includes dealing with the different subsystems (OS/2, Win32, POSIX) which a client session may wish to run.

From what I understand, you encounter no problems running your system when you "end"/close the the file ... Have you tried running MSconfig and uncheck the file from the being run in the startup?

Also, do you see the following run key in this registry location?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss.exe=%SystemRoot%\csrss.exe

Collapse -

smss.exe doesn't stop when shutting down

by pcmaster In reply to smss.exe doesn't stop whe ...

I ran MSconfig and the smss.exe file isn't on the startup list, however when looking in the task manager, the process is running.

Also, the file smss.exe is located in C:\winnt\system32\Drivers\etc where it is not on other pc's I have. There are actually two smss.exe files. One is directly in my system32 folder and the other mentioned previously. They have different dates as well. The one in my System32 folder is reflected on other machines. I tried removing the smss.exe file from the ../Drivers/etc folder, but got a different error.

The registry entry is not there, but it is also not there on other machines either. These are all Win2K Pro machines.

Collapse -

smss.exe doesn't stop when shutting down

by pcmaster In reply to smss.exe doesn't stop whe ...

This question was closed by the author

Back to Windows Forum
8 total posts (Page 1 of 1)  

Related Discussions

Related Forums